Email Header Analyzer API

POST https://api.findutils.com/api/tools/email-header-analyzer/execute

Return a structured analysis of raw email headers: sender, recipient, subject, date, message id, the Received hop chain with per-hop delays, SPF/DKIM/DMARC results, every public IP seen, and suspicious-routing flags.

Needs an API key. Running a tool needs an API key. Keys are not for sale yet: ask for early access. About API keys

Open the tool Try it

Request body

application/json

headers

string required

The raw email headers (the "Show original" / "View source" block), including every Received: line.

Example arguments

Verified

{
  "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"
}

curl -X POST https://api.findutils.com/api/tools/email-header-analyzer/execute \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"
  }'

const response = await fetch('https://api.findutils.com/api/tools/email-header-analyzer/execute', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', Authorization: 'Bearer YOUR_API_KEY' },
  body: JSON.stringify({"headers":"Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"}),
});
const data = await response.json();

import requests

response = requests.post(
    "https://api.findutils.com/api/tools/email-header-analyzer/execute",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"headers":"Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"},
)
data = response.json()

$ch = curl_init('https://api.findutils.com/api/tools/email-header-analyzer/execute');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => '{"headers":"Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"}',
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);

Also an MCP tool

Call email_header_analyzer from Claude, Cursor or any MCP client. Same arguments, same output.

https://mcp.findutils.com

MCP reference

Rate limit: 60 a minute, per IP
Auth: API key
REST id: email-header-analyzer
MCP name: email_header_analyzer
Category: Network
Machine-readable: openapi.json · markdown.md

Request body

Example arguments

More Network tools

More to explore